Orthman v. Premiere Pediatrics

545 P.3d 124

2024 OK CIV APP 7

Michael ORTHMAN, on his own behalf and on behalf of his minor children L.O. and K.O. and on behalf of all similarly situated persons, Plaintiffs/Appellants,

v.PREMIERE PEDIATRICS, PLLC, Defendant/Appellee.

Case No. 121,682

THIS OPINION HAS BEEN RELEASED FOR PUBLICATION BY ORDER OF THE COURT OF CIVIL APPEALS, Division No. 3

Court of Civil Appeals of Oklahoma, Division No. 3.

Filed January 5, 2024

Mandate Issued: February 1, 2024

APPEAL FROM THE DISTRICT COURT OF CLEVELAND COUNTY, OKLAHOMA; HONORABLE MICHAEL D. TUPPER, TRIAL JUDGE

AFFIRMED IN PART, REVERSED IN PART

William B. Federman, Tanner R. Hilton, FEDERMAN & SHERWOOD, Oklahoma City, Oklahoma, for Plaintiffs/Appellants,

Curtis J. Dewberry, DEWBERRY & HUBBARD, PLC, Oklahoma City, Oklahoma, for Defendant/Appellee.

OPINION BY THOMAS E. PRINCE, PRESIDING JUDGE:

¶1 The Plaintiffs’ claims stem from an alleged cyberattack by unknown persons on a third-party healthcare technology company, Connexin Software, Inc., which allegedly manages the electronic health records and patient data analytics of the Defendant, Premiere Pediatrics, PLLC. The trial court dismissed the Petition, with prejudice, for both a lack of standing and for failure to state a claim upon which relief may be granted based primarily on the trial court’s view that the Plaintiffs had not plead "concrete injuries-in-fact." We reverse in part and affirm in part. More specifically, we find that, as a matter of law, it was error for the trial court to dismiss the Petition based on an alleged lack of standing. We also find that, in light of the foundational principle of "notice pleading" that is firmly rooted in Oklahoma jurisprudence, it was error for the trial court to dismiss the claims for negligence, breach of implied contract, and breach of fiduciary duty based on the finding that, with respect to said claims, Plaintiffs failed to state a claim upon which relief may be granted. We affirm the trial court’s dismissal of the remaining claims under 12 O.S. § 2012B(6). We additionally find that it was error for the trial court to not give the Plaintiffs an opportunity to amend the Petition,¹ including, but not limited to, their claim for mitigation damages, which are in the nature of the expenses they expect to incur to guard against future or anticipated damages. As plead by the Plaintiffs, their mitigation damages consist of the cost of mitigating against the allegedly heightened and imminent risk of fraud and identity theft they now allegedly face. We find that, as a matter of law, such mitigation damages are not recoverable in the absence of actual past harms incurred by the Plaintiffs and, if so, only in the event the future effect of the injury or loss is shown "with reasonable certainty," not mere conjecture or probability. Thus, the trial court’s Order of September 15, 2023, is affirmed, in part, and reversed, in part, and the matter is remand- ed for further proceedings consistent with this Opinion.

BACKGROUND

¶2 This case is pursued by Michael Orthman, individually, and on behalf of his two minor children, L.O. and K.O. (collectively referred to as "Plaintiffs" or "Orthman"), and as a proposed class action on behalf of all similarly situated persons. The Petition was filed on April 12, 2023, in the District Court of Cleveland County. As alleged in the Petition, there occurred a "massive and preventable cyberattack …" on the electronic data stored in the computer network of the technology company that managed and maintained the patient data of Premiere Pediatrics, PLLC. Premiere responded to the Petition with a Special Appearance and Motion to Dismiss on or about May 9, 2023. A timely response and reply were filed by the Parties. The hearing, initially set for July 25, 2023, was continued to September 5, 2023. The trial court subsequently entered its Order of September 15, 2023, granting the Motion on the basis of a lack of standing, under 12 O.S. § 2012(B)(1), and a failure to state a claim for relief, under 12 O.S. § 2012(B)(6). This timely appeal followed.

¶3 Orthman alleges that Orthman’s "Personal and Medical Information was maintained in a condition vulnerable to a cyberattack by a third-party healthcare technology company, Connexin Software, Inc. …, which provides software solutions to assist medical facilities in managing electronic health records and patient data analytics." Orthman further claims that "[a]rmed with the Private Information accessed in the Data Breach, the data thieves can commit a variety of crimes including, inter alia, opening new financial accounts in Plaintiffs’ and Class Members’ names, taking out loans in Class Members’ names, using Class Members’ names to obtain medical services … ". Orthman asserts that "[a]s a result of the Data Breach, Plaintiffs and Class Members have been exposed to heightened and imminent risk of fraud and identity theft … [and] Plaintiffs and Class Members may also incur out of pocket costs for, e.g., purchasing credit monitoring services … or other protective measures to deter and detect identity theft."

¶4 It is alleged that Premiere is a pediatric primary care facility providing a variety of services, including well-child exams. It is alleged that on August 26, 2022, Connexin Software, the medical records service provider, employed and negligently supervised by Defendant, detected a data anomaly on its internal network, and on September 13, 2022, confirmed that an unauthorized party was able to access confidential patient data stored on its network. The Plaintiffs further contend that, despite knowing of the Data Breach for more than three (3) months, Premiere did not have Connexin begin notifying Plaintiffs and Class Members until on or around December 2022.

¶5 Regarding damages, Orthman alleged that "Plaintiffs and Class Members now face an increased risk of fraud and identity theft and must deal with that threat forever. Plaintiffs believe their Personal and Medical Information was stolen in the Data Breach and is still in the hands of the hackers. …".² Similar allegations were made multiple times in the Petition.³ On the other hand, Orthman made several generalized claims in various parts of the Petition to the effect that Plaintiffs have "suffered … actual harms …" and "concrete injury," without providing any detail or by specifically identifying any actual improper use of his personal information or PHI by a hacker, such as to secure a loan or to steal any money.⁴ One expansive description of the alleged damages that appears to be inclusive of the various injuries that Orthman claims is set out in ¶ 78 (page 25), in part, as follows: "Plaintiffs and the Class have suffered, and continue to suffer, actual harm for which they are entitled to compensation, including … [a]ctual identity theft, including fraudulent credit inquiries and cards being opened in their names; … imminent and certainly impending injury … [l]oss of privacy … [a]scertainable losses in the form of time taken to respond to identity theft … [a]scertainable losses in the form of out-of-pocket expenses … [t]he loss of use of and access to their credit … [and] [d]amage to their credit …".

¶6 Orthman attempts to allege nine claims for relief:

A. Negligence;

B. Negligence per se;

C. Invasion of Privacy;

D. Breach of Implied Contract;

E. Unjust Enrichment;

F. Breach of Fiduciary Duty;

G. Breach of Covenant of Good Faith and Fair Dealing;

H. Breach of Confidentiality; and,

I. Declaratory Judgment.

¶7 The trial court’s Order of September 15, 2023, sustained the Motion to Dismiss and specifically found, in part, that "Plaintiffs’ alleged mitigation efforts in responding to the Data Security Incident are insufficient to establish standing. (citations omitted)." The trial court also determined, with respect to each of the nine claims for relief, that Orthman had failed to state a claim for relief. In sustaining the Motion to Dismiss, the trial court dismissed Plaintiffs’ Petition with prejudice, pursuant to 12 O.S. § 2012(B)(1) and § 2012(B)(6).

¶8 The Exhibit "C" to the Petition in Error in this matter sets out fifteen separate issues.⁵ We have, however, reformulated the issues raised by Orthman to ten issues: i.e., (a) whether the trial court erred in determining that Orthman does not have standing to pursue a negligence claim because of a failure to allege damages with specificity; (b) whether the trial court erred in dismissing the claim for negligence per se; (c) whether the trial court erred in dismissing the claim for invasion of privacy; (d) whether the trial court erred in dismissing the claim for breach of implied contract; (e) whether the trial court erred in dismissing the claim for unjust enrichment; (f) whether the trial court erred in dismissing the claim for breach of fiduciary duty; (g) whether the trial court erred in dismissing the claim for breach of the implied covenant of good faith and fair dealing; (h) whether the trial court erred in dismissing the claim for breach of confidentiality; (i) whether the trial court erred in dismissing the claim for declaratory judgment and injunctive relief; and (j) whether the trial court erred in not providing Orthman an opportunity to amend with respect to the various alleged claims.

STANDARD OF REVIEW

[1] ¶9 When a motion to dismiss is granted, the standard of review is de novo. Christ’s Legacy Church v. Trinity Group Architects, Inc., 2018 OK CIV APP 31, ¶ 12, 417 P.3d 1223, 1227—1228 (citation omitted). De novo review involves a plenary, independent, and non-deferential reexamination of the legal rulings made by the trial court. Kluver v. Weatherford Hosp. Authority, 1993 OK 85, ¶ 14, 859 P.2d 1081, 1084 (citation omitted). "When evaluating a motion to dismiss, the court examines only the controlling law, not the facts. Thus, the court must take as true all of the challenged pleading’s allegations together with all reasonable inferences that can be drawn from them." Wilson v. State ex...